FireOTA
Go to console

Webhooks

Receive signed release events in Slack, PagerDuty or your own service.

Events

release.created, release.ready, release.published, release.paused, release.rolled_back, release.failed, release.archived, rollout.updated, rollout.completed, firebase.disconnected, firebase.expired, app.created.

Verify signatures

js
import { createHmac, timingSafeEqual } from "node:crypto";

// x-fireota-signature: sha256=<hex>   x-fireota-timestamp: <unix seconds>
export function verify(rawBody, headers, secret) {
  const ts = headers["x-fireota-timestamp"];
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false; // replay window
  const expected = "sha256=" + createHmac("sha256", secret).update(`${ts}.${rawBody}`).digest("hex");
  const given = String(headers["x-fireota-signature"] ?? "");
  return given.length === expected.length && timingSafeEqual(Buffer.from(given), Buffer.from(expected));
}

Retries

Failed deliveries are retried with exponential backoff (1, 2, 4, 8, 16 minutes) and then marked as dead letters. Deliveries never affect the release that triggered them.